Separation as Abstraction. Nisansala Yatapanage with Cliff Jones and Andrius Velykis Newcastle University

Transcription

1 Separation as Abstraction Nisansala Yatapanage with Cliff Jones and Andrius Velykis Newcastle University

2 Issues of separation are well handled by Concurrent Separation Logic. (at least) Some examples can be clearly developed using layers of abstraction. Two examples: Reynolds in-place list reversal algorithm and concurrent DOM trees.

3 In-place List Reversal Originally presented by John Reynolds i j k nil nil

4 In-place List Reversal Originally presented by John Reynolds i k j nil

5 In-place List Reversal Originally presented by John Reynolds nil i k

6 In-place List Reversal Originally presented by John Reynolds nil j k i

7 In-place List Reversal Originally presented by John Reynolds nil j i k

8 In-place List Reversal Originally presented by John Reynolds nil j i k

9 In-place List Reversal Originally presented by John Reynolds nil j i k

10 In-place List Reversal Originally presented by John Reynolds nil j i k

11 Abstract List Reversal while s is not empty do r' = head of s joined to r s' = tail of s end while Postcondition: r = rev(s)

12 Separation In the abstract specification, r and s are assumed to be distinct. In normal data reification, the separation is preserved.

13 Separation In the abstract specification, r and s are assumed to be distinct. In normal data reification, the separation is preserved. For Reynold s algorithm, we are reifying r and s onto parts of the same vector. This leads to a new form of reification: preservation of separation.

14 Implementation The separation has to be stated as a predicate in the invariant. The implementation can be shown to satisfy the abstract specification. a a' retr retr c c'

15 Proof retr

16 Proof At each step, recall: r' = head of s joined to r; s' = tail of s r head of s tail of s nil j i

17 Concurrent DOM Trees Philippa Gardner & colleagues published proofs using separation logic of sequential algorithms for updating DOM trees.

18 Concurrent DOM Trees Philippa Gardner & colleagues published proofs using separation logic of sequential algorithms for updating DOM trees. Our first attempt at abstraction used recursive structures. This wasn t suitable as we needed NodeID s to match with DOM.

19 Concurrent DOM Trees Abstract trees Each node has data and a list of children. Separation is implied by: Well-foundedness of the child to parent relation, ensuring no loops. No child has more than one parent.

20 Abstract Sequential Remove Pre: parent exists, child is one of parent s children

21 Abstract Sequential Remove Pre: parent exists, child is one of parent s children Post: The final state is the same except for that sub-tree removed from its parent.

22 From sequential to concurrent The sequential postcondition can state equalities about the whole system.

23 From sequential to concurrent The sequential postcondition can state equalities about the whole system. With concurrency, other processes may be operating simultaneously.

24 From sequential to concurrent The sequential postcondition can state equalities about the whole system. With concurrency, other processes may be operating simultaneously. The postcondition is weakened to form the concurrent postcondition and the guar.

25 Abstract Concurrent Remove

26 Abstract Concurrent Remove

27 Abstract Concurrent Remove The abstract post is now split into the post and guar:

28 Abstract Concurrent Remove The abstract post is now split into the post and guar: post: child is removed from parent s children list. (Nothing about the rest of the tree).

29 Abstract Concurrent Remove The abstract post is now split into the post and guar: post: child is removed from parent s children list. (Nothing about the rest of the tree). guar: this process will only change parent s children

30 Abstract Concurrent Remove The abstract post is now split into the post and guar: post: child is removed from parent s children list. (Nothing about the rest of the tree). guar: this process will only change parent s children rely: parent s children won t change

31 Data Reification Each node has data and pointers to its

32 Data Reification Each node has data and pointers to its parent,

33 Data Reification Each node has data and pointers to its parent, first child,

34 Data Reification Each node has data and pointers to its parent, first child, last child,

35 Data Reification Each node has data and pointers to its parent, first child, last child, previous sibling

36 Data Reification Each node has data and pointers to its parent, first child, last child, previous sibling and next sibling.

37 Reified Concurrent Remove rely: parent s children won t change, child s parent & siblings won t change.

38 Reified Concurrent Remove rely: parent s children won t change, child s parent & siblings won t change. guar: This may only change child s parent & sibling pointers, parent s first/last child pointers.

39 Reified Concurrent Remove rely: parent s children won t change, child s parent & siblings won t change. guar: This may only change child s parent & sibling pointers, parent s first/last child pointers. post: child s parent, prev & next siblings are nil and the sibling pointers are updated.

40 Updating siblings a b c d

41 Updating siblings a a b c d b d

42 Updating siblings a a b c d b d a b c d

43 Updating siblings a a b c d b d a a b c d c d

44 Rely/guar has been used on lock-free algorithms, e.g. 4-slot Locking

45 Rely/guar has been used on lock-free algorithms, e.g. 4-slot Locking For this algorithm, the rely/guar conditions can be satisfied by locking the parent.

46 Rely/guar has been used on lock-free algorithms, e.g. 4-slot Locking For this algorithm, the rely/guar conditions can be satisfied by locking the parent. Finer-grained locking can be accomplished by using special sentinel nodes at the corners.

47 Conclusions Handling separation by reasoning with layers of abstraction seems promising.

48 Conclusions Handling separation by reasoning with layers of abstraction seems promising. For concurrency, the sequential postcondition can be weakened to form the concurrent postcondition and the guar condition.

49 Conclusions Handling separation by reasoning with layers of abstraction seems promising. For concurrency, the sequential postcondition can be weakened to form the concurrent postcondition and the guar condition. The process was demonstrated from abstract sequential trees to abstract concurrent trees to reified concurrent trees.